syslog-ng 安装与获取远程cisco路由器日志

288次阅读

共计 5101 个字符，预计需要花费 13 分钟才能阅读完成。

今天北京网络工程师给我一个需求，要搭建一个 syslog 服务，并且接受远程路由器的日志，后来 google 一下发现用 syslog-ng 搭建比较方便，搭建还是很简单，参考 http://www.linuxidc.com/Linux/2013-11/92692.htm。

wget http://dl.Fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
yum –enablerepo=epel install syslog-ng eventlog syslog-ng-libdbi
[root@logsys0 data]# chkconfig rsyslog off; chkconfig syslog-ng on[root@logsys0 data]# service rsyslog stop;service syslog-ng start
关闭系统日志记录器：[确定]

启动 syslog-ng：[确定]
# 重新加载配置：service syslog-ng reload
由于我得 server 在内网，所以就把 selinux 和 iptables 都关闭了。关键的问题来了，下面是如何监控远程路由器的日志，网络工程师已经告诉我，他已经在 router 上将日志指向我得 server 了，以前从来没配置过，貌似国内的没有几个配置成功的文章，参考这篇文章教给你如何收取远程 cisco router 的日志 http://www.linuxidc.com/Linux/2013-11/92691p2.htm。

首先你要在文件 /etc/sysconfig/syslog-ng 里机上下面两行
SYSLOGD_PARAMS=”-r”
SYSLOG_DAEMON=”syslog-ng”
第一行是让 syslog-ng 作为一个日志服务器
第二行是让 syslog-ng 作为默认的日志服务
接下来是配置 /etc/syslog-ng/syslog-ng.conf 文件
保留原来的配置，在下面加上一下语句

source s_udp {
udp();
};
destination df_udp {
file(“/var/log/syslog/logs”);
};

log {
source(s_udp);
destination(df_udp);
};

然后 service syslog-ng restart, netstat -lntup|grep 514，查看一下 syslog-ng 有没有在监听, 如果有，这时候就可以通知网络管理员在路由器运行 logging ip addr，这里的 ip addr 是我 syslog server 的 ip 地址，这时候 tailf /var/log/syslog/logs 就可以看到远程的数据了。

Syslog-ng 的详细介绍：请点这里
Syslog-ng 的下载地址：请点这里

相关阅读：

CentOS 5.8 搭建日志管理服务器（Syslog-ng+logzilla）http://www.linuxidc.com/Linux/2012-06/62198.htm

关于 Linux 中 Syslog-ng 如何在转发时修改其 facility 以及 level http://www.linuxidc.com/Linux/2012-02/53941.htm

RHEL5 下使用 Syslog-ng 构建集中型日志服务器 http://www.linuxidc.com/Linux/2010-03/25170.htm

Quick HOWTO:syslog-ng + cisco configuration

Hi all, in this short article I will demonstrate how to configure syslog-ng to caputre cisco log messages.

Let’s start with the server side, I’m using Open SUSE11 VM in my case.
I will assume you have “syslog-ng” is already installed on your system.

So first, will need to edit /etc/sysconfig/syslog and change the following 2 lines:

SYSLOGD_PARAMS=”-r”
SYSLOG_DAEMON=”syslog-ng”

The 1st option (-r) tells the Daemon to be in passive mode – act like a logging server.
The 2nd option tells syslog Daemon to use syslog-ng as the system default logging scheme.

Our main configuration file is /etc/syslog-ng/syslog-ng.conf
Open it with your favourite text editor and add:

options {sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (yes);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};

source sys {unix-stream (“/dev/log”); internal();};
source remote {udp(); };

destination std {file( “/var/log/syslog-ng/$HOST/$YEAR$MONTH/$FACILITY” create_dirs(yes)); };

log {source(sys); destination(std); };
log {source(remote); destination(std); };

Save the file, restart the service with /etc/init.d/syslog-restart
Verify syslog-ng is running on your run-level and listening onport 514:

chkconfig –list grep syslog
syslog 0:off 1:off 2:on 3:on 4:off 5:on 6:off

netstat -ntulp “pipe” grep “:514”
udp 0 0 0.0.0.0:514 0.0.0.0:* 32446/syslog-ng

All logs will be saved under: /var/log/syslog-ng/$HOSTNAME/$DATE/$LOG
(As we have stated to be in the syslog-ng config file), the server side is done, great.

Now let’s login to our cisco router and access “configure terminal”, from there execute theese commands:

service timestamps log datetime localtime
no logging console
no logging monitor
logging 192.168.0.180

Instead of the IP address, enter your logging server IP, save the configuration and exit the router.

Let’s check if everything works, my router is called “cisco851” I’ve tried to enter privileged mode with wrong password, The result will be:
root@server01 # tail -f /var/log/syslog-ng/cisco851/200912/local4

Dec 4 14:15:58 cisco851 1895: Dec 4 12:15:59: %SYS-5-PRIV_AUTH_FAIL: Authentication to Privilage level 15 failed by paul on vty0 (192.168.0.180)

Dec 4 14:16:34 cisco851 1896: Dec 4 12:16:35: %SYS-5-PRIV_AUTH_FAIL: Authentication to Privilage level 15 failed by paul on vty0 (192.168.0.180)

We are done.